This is slowly coming together. Login and logout now works for the frontend and backend, and the api endpoints mostly require a JWT with the each request. There are still a few things to do/check before its done.
[ ] Passwords should be hashed before being stored - This can be left until later to make debugging etc easier
[x] Escape content. The content in the login/register forms should be escaped by the server before being executed. Mongoose may do this automatically, but it should be checked regardless. According to this SO post, everything is escaped by default, so it should be ok.
[x] JWT should be stored using HttpOnly; Secure flags with cookies rather than local storage. Cookies are less vulnerable to CSRF attacks
Ok, according to this article, local storage is the way to go as they are not vulnerable to CSRF, and XSS can be mitigated through sanitising input. So this should be discarded.
[x] JWT should not store the password. It's not needed and just decreases security
[x] Passwords should not be returned from a GET /api/users call
[x] GET /users/user/ should only return data to its own user.
This is slowly coming together. Login and logout now works for the frontend and backend, and the api endpoints mostly require a JWT with the each request. There are still a few things to do/check before its done.
Escape content. The content in the login/register forms should be escaped by the server before being executed. Mongoose may do this automatically, but it should be checked regardless.According to this SO post, everything is escaped by default, so it should be ok.JWT should be stored usingOk, according to this article, local storage is the way to go as they are not vulnerable to CSRF, and XSS can be mitigated through sanitising input. So this should be discarded.HttpOnly; Secureflags with cookies rather than local storage. Cookies are less vulnerable to CSRF attacks